supports stealth forwarding in IPv6, as well as in IPv4

PR: kern/54625
MFC after: 1 week

4 files changed, 22 insertions, 1 deletions

diff --git a/sys/netinet6/in6.h b/sys/netinet6/in6.h
index 05d0943..6e5aaeb 100644
--- a/sys/netinet6/in6.h
+++ b/sys/netinet6/in6.h
@@ -596,7 +596,9 @@ struct ip6_mtuinfo {
 
 /* New entries should be added here from current IPV6CTL_MAXID value. */
 /* to define items, should talk with KAME guys first, for *BSD compatibility */
-#define IPV6CTL_MAXID		42
+/* 42-44 is already used in KAME */
+#define IPV6CTL_STEALTH		45
+#define IPV6CTL_MAXID		46
 #endif /* __BSD_VISIBLE */
 
 /*
diff --git a/sys/netinet6/in6_proto.c b/sys/netinet6/in6_proto.c
index 9849d28..ce95796 100644
--- a/sys/netinet6/in6_proto.c
+++ b/sys/netinet6/in6_proto.c
@@ -64,6 +64,7 @@
 #include "opt_inet.h"
 #include "opt_inet6.h"
 #include "opt_ipsec.h"
+#include "opt_ipstealth.h"
 #include "opt_carp.h"
 
 #include <sys/param.h>
@@ -310,6 +311,9 @@ int	ip6_v6only = 1;
 
 int	ip6_keepfaith = 0;
 time_t	ip6_log_time = (time_t)0L;
+#ifdef IPSTEALTH
+int	ip6stealth = 0;
+#endif
 
 /* icmp6 */
 /*
@@ -446,6 +450,10 @@ SYSCTL_INT(_net_inet6_ip6, IPV6CTL_USE_DEFAULTZONE,
 	use_defaultzone, CTLFLAG_RW, &ip6_use_defzone,		0,"");
 SYSCTL_INT(_net_inet6_ip6, IPV6CTL_MAXFRAGS,
 	maxfrags, CTLFLAG_RW,		&ip6_maxfrags,	0, "");
+#ifdef IPSTEALTH
+SYSCTL_INT(_net_inet6_ip6, IPV6CTL_STEALTH, stealth, CTLFLAG_RW,
+	&ip6stealth, 0, "");
+#endif
 
 /* net.inet6.icmp6 */
 SYSCTL_INT(_net_inet6_icmp6, ICMPV6CTL_REDIRACCEPT,
diff --git a/sys/netinet6/ip6_forward.c b/sys/netinet6/ip6_forward.c
index e003452..5041fe8 100644
--- a/sys/netinet6/ip6_forward.c
+++ b/sys/netinet6/ip6_forward.c
@@ -34,6 +34,7 @@
 #include "opt_inet.h"
 #include "opt_inet6.h"
 #include "opt_ipsec.h"
+#include "opt_ipstealth.h"
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -161,6 +162,9 @@ ip6_forward(m, srcrt)
 		return;
 	}
 
+#ifdef IPSTEALTH
+	if (!ip6stealth) {
+#endif
 	if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
 		/* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard) */
 		icmp6_error(m, ICMP6_TIME_EXCEEDED,
@@ -169,6 +173,10 @@ ip6_forward(m, srcrt)
 	}
 	ip6->ip6_hlim -= IPV6_HLIMDEC;
 
+#ifdef IPSTEALTH
+	}
+#endif
+
 	/*
 	 * Save at most ICMPV6_PLD_MAXLEN (= the min IPv6 MTU -
 	 * size of IPv6 + ICMPv6 headers) bytes of the packet in case
diff --git a/sys/netinet6/ip6_var.h b/sys/netinet6/ip6_var.h
index 68faf9b..9a99873 100644
--- a/sys/netinet6/ip6_var.h
+++ b/sys/netinet6/ip6_var.h
@@ -326,6 +326,9 @@ extern int	ip6_use_defzone; /* whether to use the default scope zone
 				    when unspecified */
 
 extern	struct pfil_head inet6_pfil_hook;	/* packet filter hooks */
+#ifdef IPSTEALTH
+extern int	ip6stealth;
+#endif
 
 extern struct	pr_usrreqs rip6_usrreqs;
 struct sockopt;